{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6aa5346a-ee0d-54aa-b2a0-b36af379db08", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "name": "spring-aop", "version": "4.3.30.RELEASE-tuxcare.6", "purl": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:5edd57fb-25f4-551d-b6bc-ba26330fe890", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e3ecd192-bb1d-588a-99ff-9f64c715e8a5", "id": "CVE-2020-5397", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5397 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:45a6ce98-90e2-50f3-84b8-56c9b588dded", "id": "CVE-2020-5421", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5421 does not affect version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop. Version 4.3.30.RELEASE is not affected by CVE-2020-5421: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: 6327c60912cd80120040c8c16c3731d8bf6c19f6\". No backport needed." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:230930a3-2eeb-5c97-ace8-5c0d440169f1", "id": "CVE-2021-22060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ef6da09f-6f7a-55b1-8473-f887505f7f83", "id": "CVE-2021-22096", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22096 does not affect version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop. CVE-2021-22096 fix already exists in commit 4895b739b3e5fea63ecb01ac867c136add560cf6" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b7d6cfad-926f-59a0-ad25-99c8047a3e72", "id": "CVE-2021-22118", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop. Version 4.3.30.RELEASE is not vulnerable. Summary: Target repository is Spring Framework 4.3.30.RELEASE-tuxcare.2, which predates the introduction of WebFlux. The vulnerable code (reactive multipart handling with predictable temp directories) does not exist in this version. CVE-2021-22118 specifically affects WebFlux applications in Spring Framework 5.2.x prior to 5.2.15 and 5.3.x prior to 5.3.7. WebFlux was introduced in Spring Framework 5.0, and the vulnerable multipart han [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:3c24aadd-720d-5039-bb3a-915e3ca031ec", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b037fd01-6211-54da-8a84-4d4fc406c897", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:76d6cd3a-b77e-593a-85ff-7ee18235b1de", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f6bc2737-bd0b-5e85-93d6-39412f774e53", "id": "CVE-2022-22970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d361a854-b0dd-5e83-89de-806ae6f61a25", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8989620a-942b-50e7-9739-11993b05bf42", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6daaa667-bd9d-5824-b824-5f4207c270cb", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ab83416b-0925-51f8-b8f9-9f84507aeca2", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:be277faf-c81c-517d-922e-58c81ebfd401", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:4f661280-9e95-502c-b728-491b38335a15", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6edfa19c-97dc-5148-8463-0cccb320f28b", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:27987afa-2fec-5754-a648-548652ad42d2", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f986b4e4-091c-574f-a062-afa640003c1f", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:88663246-cb66-5314-9c2a-bc57b2c9085e", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f41ca12c-2c6b-5e87-a633-1f8cb960f4dc", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f1e17207-8cd7-5efb-acb7-00b7db90f3c0", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ebf65775-6ccb-5e8c-a92a-4fa78478ad30", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a5cf9513-2d9b-5a1b-9cff-c64c6b79395b", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:741c73b9-faa0-59d2-9880-c0493dfca5de", "id": "CVE-2026-22740", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop. CVE-2026-22740 is a WebFlux-specific vulnerability (reactive multipart temp-file cleanup in org.springframework.http.codec.multipart.MultipartHttpMessageReader / PartGenerator). Spring Framework 4.3.30.RELEASE predates WebFlux entirely - the org.springframework.http.codec package does not exist in this version, and there is no reactive multipart code path. Per NVD, affected versions are 5.3.x, 6.1.x, 6.2.x, 7.0.x only; Spring 4.x is not in the affected range." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d81e4666-b6ee-55e1-bd66-350287e5a9e3", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0f7bd710-ce9a-58ae-950c-c29b2bf614ae", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:4ee393de-7017-5ef2-9eb3-2aab4e7e406f", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c4ccd01b-b04b-5da8-b7d5-54f6f70e154e", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0455c7c7-b856-5616-8501-ab9d8a097cad", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8d066555-b9d4-51c5-b32a-ff828b865e28", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d4f6d754-e11c-5660-bbfb-444aeb695363", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c79c94e9-959e-52c5-ba31-df0278a69fd6", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ed2bac66-b2ab-5f98-922e-292612cdc107", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:afbd0e35-7509-5571-8455-46ad64cfb0fa", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:59ebaba2-51cb-5fa1-b409-5b1cfc393590", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:58a7ca53-f9e0-565b-88d0-f6f3a70a5608", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6aff36f7-e16d-55b1-9f6d-4d7b3762b609", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:7ec39036-e1aa-5650-a532-5e0866b6d1fa", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:2760e862-0d9f-57a4-8ee9-a0cbaaf422c4", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop. not_affected \u2014 Spring Framework 4.3.30 is not affected by CVE-2026-41853. This version predates Spring WebFlux (introduced in 5.0) and lacks the vulnerable component DefaultServerWebExchange.java. The vulnerability mechanism - Spring Framework's message reader selection based on wildcard Content-Type headers - does not exist in this servlet-based Spring MVC architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:72ddbf34-1b39-5078-851b-08dc544b45db", "id": "CVE-2026-41854", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:bb8ef934-6edf-5df2-8444-0c0f278cbf06", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 4.3.30.RELEASE-tuxcare.6 of org.springframework:spring-aop." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-aop@4.3.30.RELEASE-tuxcare.6" } ] }